Runtime & cross-device consent endpoints

Alongside the authenticated Developer REST API (/v1/*, fck_ key), Cookie Munch exposes a small set of public, unauthenticated endpoints under /api/v1/*. These are the ones the consent.js embed calls automatically from the browser — you rarely call them by hand, but they're documented here because they're a public surface and are useful when you build your own client (native app, custom banner, or a cross-device consent integration).

Base URL: https://api.cookiemunch.net. No Authorization header — these are anonymous, CORS-open, and scoped to a single property by its cbid. Never send personal data to them (the observed feed takes cookie names only, never values).

Cookie declaration feed

GET /api/v1/{cbid}/cookies — the latest categorized cookie snapshot for a property. This is what powers the auto-updating cookie-declaration table.

curl https://api.cookiemunch.net/api/v1/acme-com-9f3k/cookies

{
  "updatedAt": "2026-09-15T12:00:00.000Z",
  "cookies": [
    { "name": "_ga", "category": "statistics", "vendor": "Google Analytics", "description": "…", "expiry": "2 years" }
  ]
}

Observed-cookie ingest

POST /api/v1/{cbid}/observed — the embed reports the cookie names and external script hosts it actually sees on the live page, which merge into the property's scan snapshot so the declaration reflects real-world usage. Cookie values are never sent.

curl -X POST https://api.cookiemunch.net/api/v1/acme-com-9f3k/observed \
  -H "Content-Type: application/json" \
  -d '{ "cookies": ["_ga", "_fbp"], "scripts": ["https://connect.facebook.net"] }'

Returns 204 No Content on success.

Cross-device consent profile (consentSync)

These let a signed-in user's consent choices follow them across devices and surfaces. Your app supplies a stable, non-PII userId (a hash or opaque id — never an email). This is the HTTP surface behind the SDK/embed consentSync feature.

Write — POST /api/v1/{cbid}/profile

curl -X POST https://api.cookiemunch.net/api/v1/acme-com-9f3k/profile \
  -H "Content-Type: application/json" \
  -d '{
    "userId": "u_8fa3…",
    "choices": { "statistics": true, "marketing": false },
    "stamp": "1a2b3c…",
    "version": 3,
    "utc": 1789900000000
  }'

Read — GET /api/v1/{cbid}/profile/{userId}

{ "choices": { "statistics": true, "marketing": false }, "stamp": "1a2b3c…", "version": 3, "utc": 1789900000000 }

version is a monotonically increasing counter used to reconcile the newest choice when the same user updates consent on two devices; stamp ties the choice back to a consent-log record. Because these endpoints are unauthenticated, treat userId as opaque and don't put anything sensitive in it.

A note on /api/v1/sites/{cbid}/scan

You may also see POST/GET /api/v1/sites/{cbid}/scan in network traces — those are the dashboard's session-authenticated scan endpoints. For programmatic scans use the documented Developer API equivalents, POST/GET /v1/sites/{cbid}/scan, with your fck_ key.